Russian antivirus firm Kaspersky Lab is on the hunt for developers to complete a secure operating system that could fend off the next Stuxnet attack on industrial control systems.
The company, which earlier this year reported the discovery of ‘super-weapon’ malware Flame, is seeking a developer and analyst to help create an operating system that prevents untrusted items from executing on process control systems (PCS), according to Russian recruitment site, HeadHunter.
The postings say the Kaspersky Lab project “is developing rapidly”. It wants recruits with experience programming PCS and Supervisory Control And Data Acquisition (SCADA) systems, implementing industrial networking and communications protocols, and knowledge of Siemens, Emerson, Omron, ABB and other programmable logic controllers.
Some of the core software flaws Stuxnet exploited to attack Iran's Natanz nuclear enrichment facility were the Siemens Simatic STEP 7 and Simatic PCS 7 that the German company patched (PDF) last month.
Recruits would also need knowledge of Windows, Linux and QNX, which is used in industrial control systems and more recently has been put to work in RIM’s PlayBook.
Russian news site CNews last week reported the two roles on offer at Kaspersky Lab, noting the project was likely a response to Stuxnet that could fill a gap in the field of Windows-based process virtualisation security.
The company has not commented on the job postings, but Kaspersky Lab chief, Eugene Kaspersky, dropped a big hint at the AusCERT conference in May, telling the audience SCADA was “not possible to protect” and that these systems could be “very easy victims”.
“The only way to protect critical infrastructure – is to redesign SCADA systems based on a secure operating system. It is possible to do, but it requires a redesign of all the software for industrial systems,” CSO.com.au reported at the time.
Cyber security researcher and CEO of Taia Global, Jeffrey Carr, said a Kaspersky-made secure operating system for industrial control systems “makes a lot of sense” and would probably be in high demand, but he also points to Kaspersky’s “close relationship to Russia’s security services”.
“Under Russian law, the FSB could ask Kaspersky to include a backdoor in its secure O/S and the company would be required to comply. In fact, I can't imagine the FSB missing out on such an opportunity for intelligence collection against potential customers among the Commonwealth of Independent States, India, China, South Africa and others.”
Taia’s analysis (PDF) of Russian law and the implications for Kaspersky Lab products was linked-to in a recent [[XREF: http://www.wired.com/dangerroom/2012/07/ff_kaspersky/all/ |Wired profile|]] of Mr Kaspersky that highlighted his connections to the Kremlin and its security arm, the FSB.
Kaspersky responded to the piece with a lengthy list of corrections, including that the company provided ‘expertise and nothing more’.